Bannau Brycheiniog National Park Authority Privacy Notice
Keeping your Information Safe.
Last updated: 21st November 2025
How we use your personal information
This privacy notice is to let you know how Bannau Brycheiniog National Park Authority will look after your personal information. This includes:
· The information you tell us about yourself.
· Information we learn about you through having you as a customer or supplier, employee, volunteer, service user, supporter, partner, contractor or when carrying out our regulatory duties as a public authority.
·The choices you give us about what marketing or information about the Authority you want us to provide to you.
This notice explains how we do this and tells you about your privacy rights and how the law protects you. This notice may change from time to time, so please check our website occasionally to ensure that you are happy with any changes
Who we are
Bannau Brycheiniog National Park Authority was created as a free-standing special purpose local authority under the 1995 Environment Act (the Act). You can find out more about us on the Authority’s website.
If you have any questions or want more details about how we use your personal information, you can contact our Data Protection Officer.
dp*@*************ov.uk
01874 624437
You can also write to us at:
Data Protection Officer
Bannau Brycheiniog National Park Authority
Plas Y Ffynnon
Cambrian Way
Brecon
LD3 7HP
Bannau Brycheiniog National Park Authority is registered as a Data Controller with the ICO (Information Commissioners Office). Registration number: Z6715800
How the law protects you
Your privacy is protected by law and this section explains how that works.
We set out how we meet accountability measures in the law and how we keep your information safe in our Data Protection Policy.
Your rights
Under data protection regulations you have the following rights:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling.
The lawful basis of processing influences which rights are available to the individual.
Proper reasons (lawful basis) for using your personal data
Data Protection law says that we are allowed to use personal information only if we have a proper reason (lawful basis) to do so. This includes sharing personal information with others outside the Authority.
The law says we must have one or more of these reasons:
- It is necessary for the performance of a task relating to the National Park Authority’s public and regulatory duties
- To fulfil a contract we have with you, or
- When it is our legal duty, or
- When it is in our legitimate interest, or
- When you consent to it.
A legitimate interest is when we have a business or commercial reason to use your information that is not related to our public and regulatory duties as a National Park Authority.
There are additional reasons (lawful bases) that the Authority must meet when processing special category data.
The data we collect
We may collect personal information about you or your business from these sources:
Data you give to us:
- When you complete an application form, such as a job, volunteering, planning application
- When you apply for our services, such as booking to attend an event or speak at a public meeting
- When you talk to us on the phone, e-mail or send us a letter
- When you use our website
- In emails and letters
- When you make a purchase or enter into a contract with us
- When you sign up to become part of a network or group we facilitate
- In insurance claims or other documents
Data we collect when you use our services or visit our locations:
- Payment and transaction data
- Online profile and usage data. This includes the use of cookies and logging IP addresses when you access our website
- Usage and engagement data for services
- Planning Application data
- Case file notes from meetings
- CCTV Footage
- Footage collected from Body Worn Cameras used across the Authority
Data from third parties we work with:
- Organisations that sign post you to us
- Project partners
- Insurers
- Cardiff City Council – Payroll Services
- Powys Pensions
- Social networks
- Fraud prevention agencies
- Land agents
- Public information sources such as Companies House
- Agents working on our behalf
- Medical practitioners & Occupational Health
- Government and law enforcement agencies.
The information we collect from you and what it is used for
Job Applicants, Work Experience and Student Placement requests
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Processing Job Application | Fulfilling Contracts Our Legal Obligations |
|
| Processing Work Experience/ Student Placement Requests | Legitimate Interest | People can take up work experience and student placements with the Authority |
| Health and Safety | Fulfilling contracts Our legal obligations |
|
| Making reasonable adjustments | Our public task Our legal obligations |
Fulfil requirements under the Equality Act 2010 |
| Equality monitoring data | Our public task Our legal obligations |
Fulfil requirements under the Equality Act 2010 |
Members
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Keeping in contact with you and providing you with information to fulfil your role | Our Public Task Our Legal Obligations Legitimate Interest |
Effective Governance of the Authority |
| Processing Expenses Payments | Our Public Task Our Legal Obligations Legitimate Interest |
Remuneration of Members |
Volunteers
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Processing your volunteer application | Our Public Task Our Legal Obligations Legitimate Interest |
Working with volunteers to fulfil National Park Purposes |
| Keeping in contact with you | Legitimate Interest | Volunteers are kept up to date with opportunities |
| Tailoring volunteering experiences and making reasonable adjustments | Our Public Task Our Legal Obligations Legitimate Interest Consent – in relation to health data |
Increasing access to volunteering opportunities. Fulfil requirements under the Equality Act 2010 |
| Health and Safety | Our Legal Obligations | |
| Equality Monitoring | Our Public Task Our Legal Obligations |
Fulfil requirements under the Equality Act 2010 |
Service Users, Customers, Contractors, Partners and Suppliers – across our services including carrying out our functions as a local planning authority
Service users, customers, contractors, partner and supplier personal data is used across our services and in association with Planning Applications, including administering the monitoring, appeals and objection process in conjunction with Planning and Environment Decisions, Wales, responding to statutory and non-statutory pre-application enquiries and permitted development enquiries, responding to screening and scoping opinions and investigating potential enforcement matters. This is detailed as follows:
|
What we use your personal information for |
Our Reasons | Our public tasks or legitimate interests |
| :
Processing, making decisions and providing advice on planning and related applications |
Our Public Task Our Legal Obligations Legitimate Interest |
Fulfilling planning Authority duties |
| Keeping in contact and seeking feedback about the service we provide | Our Public Task Our Legal Obligations Legitimate Interest |
Managing ongoing relationships and improving services |
| Drafting planning policies, preparing Local Development Plans, Strategic Development Plans, Place Plans and associated planning policies / guidance / appraisals | Our Public Task Our Legal Obligations Legitimate Interest |
Public have opportunity to influence local planning policy. Fulfilling Delivery agreement obligations |
|
Monitoring development, investigating alleged breaches of planning control and enforcing unlawful development |
Our Public Task Our Legal Obligations Legitimate Interest |
Fulfilling planning Authority duties |
| Seeking comments for Planning Policy reasons, for example the Local Development Plan | Our public task Our legal obligations Legitimate interest | Public have opportunity to influence local planning policy. |
| Fulfilling delivery agreement obligations | Our public task Our legal obligations Legitimate interest | Fulfilling planning Authority duties |
| Processing Planning fees – including getting in contact with you about it if needed | Contract Our legal obligations Legitimate interest | Effective processing of planning fees. |
| Information required for financial and performance monitoring and auditing requirements | Our legal obligations | Fulfilling planning Authority duties |
| Entering legal agreements and carrying out our obligations arising from any contracts entered into by you and us (under Section 106 Town and Country Planning Act 1990) | Fulfilling contracts | Fulfilling planning Authority duties |
| Processing and recording planning Objections | Our public task Our legal obligations Legitimate interest | Fulfilling planning Authority duties |
| Photos relating to planning applications, objections and appeals | Our public task Our legal obligations Legitimate interest | Fulfilling planning Authority duties |
| For review and consideration at internal Committee meetings | Our public task Our legal obligations Legitimate interest | Decision making at Committees |
| Processing Payments – including getting in contact with you about it if needed | Contract Our legal obligations Legitimate interest | Effective processing of payments |
| Manage our relationship with you or your business | Legitimate interest Our legal obligations Legitimate interest | Effective supplier, customer, partner and contractor relationships |
| To carry out our obligations arising from any contracts entered into by you and us | Fulfilling contracts | Fulfilling planning Authority duties |
| Recording of telephone conversations to customer services team for monitoring and training purposes. This applies to outgoing and/ or incoming calls. Call recordings will be turned off, when your credit or debit card details are given.
Note: All recordings will be deleted after 30 days. This may be extended however in circumstances where the recording is necessary to support the investigation into incident or is required as evidence. A message explaining that the call may be recorded will be played at the start of all telephone calls we receive. If Officer is making outgoing call that is recorded they will make recipient aware at the start of the call. |
Legitimate interest | Ensuring you receive a quality service from us. To investigate and resolve a complaint; Protecting our staff’s personal safety and welfare e.g. from abusive callers; Training Customer Services Staff. |
| Liaising with relevant contacts for rights of way and conservation management | Our Public Task Our Legal Obligations Legitimate Interest |
Fulfilling National Park purposes. Effective delivery of services. |
| Processing event bookings -including getting in contact with you about it if needed | Legitimate Interest | Effective processing of booking for events that promote National Park purposes |
| Assessing Tenders | Our Legal Obligations | Fulfilling planning Authority duties |
| Information required for financial auditing requirements | Our Legal Obligations | Fulfilling planning Authority duties |
| Accounting for our decisions and investigation of corporate complaints | Our Legal Obligations | Fulfilling planning Authority duties |
Members of Networks or Groups we facilitate
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| For arranging meetings and sending out information relating to the work of the group | Our Public Task Our Legal Obligations Legitimate Interest |
Working with others to fulfil National Park Purposes |
| Processing expenses payments | Our legal obligations Legitimate interest |
Remuneration of Access Forum Members |
Engagement (including online) and Marketing
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Keeping in touch with information about events at our centres | Our Public Task Consent – when you sign up to a mailing list |
Promoting Special Qualities of the Park |
| Manage opportunities at the Centres, at events, or via Ambassador schemes for businesses and stall holders | Legitimate Interest – Ongoing Relationship Consent – New Contact |
Manage ongoing relationships effectively so people are aware of opportunities available |
| Dealing with entries to competitions. | Legitimate Interest | Enabling effective delivery of competitions |
| Analysing visits to our website | Legitimate Interest Consent – Cookie Policy |
Enable us to analyse and improve website experience |
| Photos | Legitimate Interest
Consent |
Enable us to publicise and engage people with the work the Authority does |
| To administer Authority’s newsletters | Consent – when you sign up to a mailing list | Keeping people engaged and up to date on latest news about the Authority and our work |
Supporters
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Processing your donation | Our Legal Obligations Legitimate Interest |
Fulfilling National Park purposes. Effective delivery of services. |
| Keeping in contact with you about opportunities to support the Authority | Consent | Keeping people engaged and up to date on latest news about the Authority and our work |
Governance and Accountability
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| Processing queries, comments, feedback and complaints you submit | Public Task Legal Obligations Legitimate Interest |
Fulfil the Authority’s statutory purposes and duty, service standards and Freedom of Information, Environmental Regulation and Subject Access requirements. |
CCTV and Body Worn Camera Footage
We operate Closed Circuit Television (CCTV) throughout various locations within the Bannau Brycheiniog National Park Authority. We may also use, in certain locations across the Authority, Body Worn Cameras.
Our CCTV and Body Worn Cameras captures live visual and audio images (there is no audio captured by our CCTV) and any recordings are retained for a period of 30 days. This may be extended however in circumstances where the CCTV or Body Worn Cameras footage is necessary to support the investigation into an incident or is required as evidence.
Please note clear signage is in place within Bannau Brycheiniog National Park Authority areas that are being monitored by CCTV.
CCTV camera positions are reviewed annually to ensure that they remain proportionate to their purpose. Where the purpose can no longer be justified against the intrusion on personal privacy, they will be removed or switched off.
The Authority will monitor and respond to any concerns or complaints that it receives relating to the positioning of cameras and their field of vision. Where the position and purpose can no longer be justified against the intrusion on personal privacy or property, they will be removed or switched off.
| What we use your personal information for | Our Reasons | Our public tasks or legitimate interests |
| To protect staff, Members, volunteers, visitors and members of the public with regard to their personal safety. | Legitimate interest
Legal Obligations Public Task If criminal offence data is captured in these cases the capture of the image would relate to substantial public interest and test 10. preventing and detecting of unlawful acts and 11. Protecting the Public |
Legitimate Interest in terms of protecting staff, Members, volunteers, visitors and members of the public with regard to their personal safety. |
| Deterring violent or aggressive behaviour towards BBNPA staff. | Deterring violent or aggressive behaviour towards BBNPA staff. | |
| To protect the Authority’s buildings and equipment, and the personal property of, staff, Members, volunteers, visitors and members of the public. | To protect the Authority’s buildings and equipment, and the personal property of, staff, Members, volunteers, visitors and members of the public. | |
| Preventing and detecting crime at its sites and retail facilities and assist in the identification and apprehension of offenders. | Preventing and detecting crime at its sites and retail facilities and assist in the identification and apprehension of offenders. | |
| To provide evidence of damage or loss to the Authority’s insurance company. | To provide evidence of damage or loss to the Authority’s insurance company. |
How long we keep your information for
We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information for a set length of time to fulfil our statutory obligations, for example planning, financial or human resources records. We will only hold your personal information on our systems or on file for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us.
Who we share your personal information with
We may share your personal information internally with relevant departments within the Authority but only for specified purposes.
We may share your personal information externally with these organisations and for the following reasons:
| Organisations | Our Reason |
| HM Revenue and Customs, Regulators and other Authorities | Auditing purposes, Fraud and crime detection |
| Powys Pensions | They administer the Authority’s pension scheme |
| Cardiff City Council | They provide and host the Authority’s payroll |
| Carmarthenshire County Council | They provide and host the Authority’s finance system |
| People you agree to us sharing your data with | You have consented for data to be shared |
| Partners, third party contractors and Suppliers | Fulfilling National Park purposes including our Public Tasks, Legal Obligations and to ensure effective delivery of services. |
| Government, Insurers and law enforcement agencies | Fulfilling National Park purposes including our Public Tasks, Legal Obligations and to ensure safe and effective delivery of services. |
How we use your personal information to make automated decisions
Currently we don’t use your information to make automated decisions. If this changes in the future we will update this section of the notice.
If you choose not to give personal information
We may need to collect personal information by law, or under the terms of a contract we have with you.
If you choose not to give us this personal information, it may delay or prevent us from meeting our obligations. It may also mean that we cannot perform tasks related to a service you are looking to access.
Any data collection that is optional would be made clear at the point of collection
Consent and withdrawing consent
Where individual consent is needed to process personal information we will make you aware. Consent will not generally be a precondition of signing up to a service.
You can withdraw your consent at any time. Please contact us if you want to do so at en*******@*************ov.uk or the relevant team within the Authority who you provided consent to.
If you withdraw your consent, we may not be able to provide certain information or services to you. If this is the case, we will tell you.
How to get a copy of your personal information
You can access your personal information we hold by writing to us or filling in this form and sending it to this address:
Corporate Services Officer
Bannau Brycheiniog National Park Authority
Plas Y Ffynnon
Cambrian Way
Brecon
LD3 7HP
Or emailing it to: en*******@*************ov.uk
If you need assistance to complete the form please contact:
en*******@*************ov.uk/ 01874 624437
Letting us know if your personal information is incorrect
If we hold information about you, you can ask us to correct any mistakes by contacting us at en*******@*************ov.uk or phoning us on 01874 624437, writing to us or contacting the relevant team within the Authority who you provided the information to. We will take reasonable steps to check the accuracy of the data we hold and correct it.
What if you want us to stop using your personal information?
You have the right to object to our use of your personal information, or to ask us to delete, remove, or stop using your personal information if there is no need for us to keep it.
There may be legal or other official reasons why we need to keep or use your data. But please tell us if you think that we should not be using it.
We may sometimes be able to restrict the use of your data. This means that it can only be used for certain things, such as legal claims or to exercise legal rights. In this situation, we would not use or share your information in other ways while it is restricted.
You can ask us to restrict the use of your personal information if:
- It is not accurate.
- It has been used unlawfully but you don’t want us to delete it.
- It is not relevant any more, but you want us to keep it for use in legal claims.
- You have already asked us to stop using your data but you are waiting for us to tell you if we are allowed to keep on using it.
If you want to object to how we use your data, or ask us to delete it or restrict how we use it or, please contact us at dp*@*************ov.uk/01874 624437
Cookies
To find out more about how we use cookies please see our cookie notice.
Sending data outside the European Economic Area
We will only send your data outside of the European Economic Area (‘EEA’) to:
- Comply with a legal duty.
- When data processors we use send data outside the EEA but have relevant safeguards in place.
If we or a processor we use do transfer information outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. We’ll use one of these safeguards:
- Transfer it to a non-EEA country with privacy laws that give the same protection as the EEA.
- Put in place a contract with the recipient that means they must protect it to the same standards as the EEA.
- Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA. You can find out more about data protection on the European Commission Justice website.
16 or under
We are committed to protecting the privacy of children aged 16 or under. If you are aged 16 or under‚ please ensure you get your parent/guardian’s permission beforehand whenever you provide us with personal information.
How to complain
Please let us know if you are unhappy with how we have used your personal information. We will acknowledge your concerns within 30 days of receipt and provide a full response thereafter, without undue delay. Please contact our data protection officer at dp*@*************ov.uk/01874 624437 .
You also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern. Their helpline number is 0303 123 1113.